The moment they'd access to Safe Wallet ??s process, they manipulated the consumer interface (UI) that clients like copyright workforce would see. They replaced a benign JavaScript code with code designed to alter the intended desired destination in the ETH within the wallet to wallets managed by North Korean operatives. This malicious code would